Security research

What actually attacks a company website

Every website on the internet is probed by automated programs within hours of going live. We record what they look for on our own site, study it, and publish what company owners can do about it.

12 October 2026 – 18 October 2026

This week so far
bot requests
1,101
source addresses
70
countries
28
login guesses
13

What they looked for

  1. Secret configuration files (.env)697
  2. WordPress172
  3. PHP files97
  4. Code history folder (.git)47
  5. Other configuration files40

Most requested addresses

  1. /.env51
  2. /.env.local27
  3. /.env.backup24
  4. /.env.production23
  5. /.env.bak21

Where we contribute

Our sensor data does not stop at this website. We feed public security databases that other administrators use to protect their systems.

AbuseIPDB

IP addresses that clearly attack our website, with the kind of attack. Reported automatically, at most once a day per address.

GitHub

Our sensor's weekly records as open data (CC BY 4.0). Anyone may use them, with credit.

How we work

We only observe

Our data comes from the requests automated scanners send to digimasi.com itself. We never scan or test anyone else's website.

Software is tested on our own machines

When we examine open-source software, we install it ourselves and test only that copy.

Developers hear first

A problem we find is reported privately to its developers, and published only after a fix is available or 90 days have passed.

Read the full methodology →

Found a security problem on our website?

Write to security@digimasi.com